Flex Anyconnect vpn and site to site VPN

[MriduD]

Hello all, I need your help to come up with a solution.

A user is connected remotely to host location via flex Anyconnect remote vpn(vpn pool - 172.17.1.1 to 172.17.1.40). And also, there is a site to site VPN between the host location(192.168.1.0/24) and branch location(192.168.2.0/24). He wants to print out of a printers at192.168.2.19,.20,21,22) which are in branch location. Both locations have Cisco iosxe routers. How do I achieve it?  Please help me with the routes. 

[MHM Cisco World]

Yes friend I see it but I don't know the printer subnet.

Anyway' not need printer IP specifically' 

If you allow printer subet in acl of s2s vpn that perfect 

Now 

Four other points 

1- vpn pool of anyconnect must also add to acl of s2s vpn

2- in branch you need to config route toward host for vpn pool  anyconnect

3- in host you need to add printer subnet to acl of set route under crypto authorization policy 

4- last point add printer and vpn pool anyconnect to zone policy ( do above three point and if you see drop in policy we can modify config to cover these IP)

MHM

[MriduD]

Main site subnet - 26.1.1.0/24

Branch subnet/printer(192.168.2.21) --192.168.2.0/24

Vpn pool 172.16.7.1 - 172.16.7.40

Crypto acl of main site:

Ip access-list extended NewJersey
10 permit ip 26.1.1.0 0.0.0.255 192.168.2.0 0.0.0.255
*20 permit ip 172.16.7.0 0.0.0.255 192.168.2.0 0.0.0.255*

Crypto acl of branch:

 ip access-list extended Denver
10 permit ip 192.168.2.0 0.0.0.255 26.1.1.0 0.0.0.255
*20 permit ip 192.168.2.0 0.0.0.255 172.16.7.0 0.0.0.255*

1. Added already 

2. Static route in branch is missing. I thought the crypto acl in the branch will send the return traffic.

Should I configure this in branch?

Ip route 172.16.7.0 0.0.0.255 26.1.1.1

3. Added already 

[MHM Cisco World]

2. Static route in branch is missing. I thought the crypto acl in the branch will send the return traffic.

Should I configure this in branch?

Ip route 172.16.7.0 0.0.0.255 26.1.1.1

No need I check your config you already have defualt route toward interface config as crypto map.

If we finsh these points try from anyconnect ping to printer IP

MHM

[MHM Cisco World]

So any update?

Did you check if anyconnect have add route or printer toward main site?

And more did main site have route toward branch for printer subnet ?

MHM

[MriduD]

Hi Sir, I have attached the latest configs. There are no static routes. Just policy based site to site VPN. So, the subnets have been advertised in the crypto ACLs.

[MHM Cisco World]

ip access-list standard VPNACL
 10 permit 26.1.1.0 0.0.0.255
 20 permit 192.168.2.0 0.0.0.255 <- remove this 

Under crypto ikev2 authorization policy <>

Add below

Route set remote ipv4 192.168.2.0 255.255.255.0

And in host route you mandatory need route to printer subnet

Ip route 192.168.2.0 255.255.255.0 g0/0/0 

The acl encrypt or not data not routing it.

MHM

[MriduD]

Done.

But when I added 'Ip route 192.168.2.0 255.255.255.0 g0/0/0' to the main site router, communication between the main site and branch stopped working.

[Richard Burts]

I am looking at the new configs, but want to respond sooner about the suggestion to add the static route Ip route 192.168.2.0 255.255.255.0 g0/0/0. When you configure a static route to specify the outbound interface but not the next hop (and when the outbound interface is Ethernet) then it requires that the router arp for EVERY remote address in that network. And it requires that the next hop device support proxy arp so that it will respond to the arp requests. Many ISP do not support proxy arp considering it a security risk. I suspect this is why communication failed when you added that static route.

I am not sure that the static route is needed (pending review of the config). But if it is needed then it needs to specify a next hop address.

[Richard Burts]

I do not think that you need to add a static route for 172.16.7.0. And if you do add the static route the next hop should NOT be 26.1.1.1. The config of the branch does not have any information about 26.1.1.0 and so would use the default route. Any route with a next hop of 26.1.1.1 will not be used and the default would cover it.

Have you made modifications to OutsideToInsideACL?

If we are still trying to find a solution then perhaps it would be beneficial to post a fresh copy of the branch config (especially since there seems to be some confusion if the posted copy was the right one)?

[MriduD]

Removing attachments. Let me know if you need them again

please check the configs.

[balaji.bandi]

they know how to reach each other in routing table ?

traceroute can help you where the packets dropping, if you are not NATiing.

[MriduD]

I may be wrong..as I am a newbie.

But, since I have configured policy based site to site vpn, I don't think the routes will show as an output of the command show ip route. Please advise 

[balaji.bandi]

but atleast you will know when do traceroute the path it taking and failing for simple troubleshoot.

[leoyue09]

• Double-check the actual printing protocol used by your printers (LPD is common, but some might use RAW or other protocols). Adjust the ACL rule accordingly to allow the specific port used.
• Consider implementing DNS resolution on the user's remote machine for easier printer identification by hostname instead of IP address.
• For troubleshooting, use debug commands on the routers to monitor traffic flow and identify any potential issues.

[MriduD]

Thank you for the advice,leo.

In the crypto acl, I have permitted ip level access between the subnets. Shouldn't that take care of it?